VDB

CVE-2026-47295

CVE-2026-47295 PUBLISHED CVSS 8.8 HIGH

Reported by microsoft · Published July 14, 2026

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Risk Scores

CVSS 3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
MicrosoftMicrosoft SQL Server 2016 Service Pack 3 (GDR)13.0.0
MicrosoftMicrosoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack13.0.0
MicrosoftMicrosoft SQL Server 2017 (CU 31)14.0.0
MicrosoftMicrosoft SQL Server 2017 (GDR)14.0.0
MicrosoftMicrosoft SQL Server 2019 (CU 32)15.0.0.0
MicrosoftMicrosoft SQL Server 2019 (GDR)15.0.0
MicrosoftMicrosoft SQL Server 2022 (GDR)16.0.0
MicrosoftMicrosoft SQL Server 2022 for x64-based Systems (CU 25)16.0.4260.1
MicrosoftMicrosoft SQL Server 2025 (CU 6)17.0.4060.2
MicrosoftMicrosoft SQL Server 2025 for x64-based Systems (GDR)17.0.1050.2
MicrosoftMicrosoft SQL Server 2025 for x64-based Systems (GDR)17.0.1050.2, 17.0.1050.2, 17.0.1050.2
microsoftsql_server_202517.0.4060.2, 17.0.1050.2, 17.0.4060.2
MicrosoftMicrosoft SQL Server 2019 (CU 32)15.0.0.0, 15.0.0.0, 15.0.0.0
MicrosoftMicrosoft SQL Server 2022 for x64-based Systems (CU 25)16.0.4260.1, 16.0.4260.1, 16.0.4260.1
MicrosoftMicrosoft SQL Server 2022 (GDR)16.0.0, 16.0.0, 16.0.0
MicrosoftMicrosoft SQL Server 2017 (GDR)14.0.0, 14.0.0, 14.0.0
MicrosoftMicrosoft SQL Server 2025 (CU 6)17.0.4060.2, 17.0.4060.2, 17.0.4060.2
microsoftsql_server_201613.0.0, 13.0.0, 13.0.0
MicrosoftMicrosoft SQL Server 2016 Service Pack 3 (GDR)13.0.0, 13.0.0, 13.0.0
MicrosoftMicrosoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack13.0.0, 13.0.0, 13.0.0

…and 5 more

Timeline

  • Jul 14, 2026 CVE Published
  • Jul 15, 2026 Coalition ESS Score
  • Jul 15, 2026 Security Advisory
  • Jul 16, 2026 Security Advisory
  • Jul 22, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›